Does the enterprise impose security requirements on its own suppliers?

Supply chain is one of the ten measures

Yes, in most cases this is relevant to answer with a reference to concrete supplier policy, not with a general reassurance. The question comes directly from Article 21(2) of the NIS2 Directive, where "supply chain security" appears as a separate point alongside the other nine measures. The customer does not want to know whether you yourself are well secured, but whether you pass on this requirement to the parties on which you depend: hosting providers, software suppliers, IT service providers.

Concretely, this concerns questions such as: are there security requirements in the contracts with critical suppliers, is security level assessed during procurement or onboarding, and is there visibility of dependencies further down the chain. An enterprise that has its own information security policy — see also the question about policy for risk analysis and the security of information systems — often already has a framework in which supplier assessment is a standard part. If that is lacking, then "no" or "partly" is an honest answer; a commitment about what should happen is not our role here.

Where this appears in Article 21(2) NIS2

Article 21(2) of Directive (EU) 2022/2555 names supply chain security as one of the ten measures an entity must take, including attention to the relationship between the entity and its direct suppliers or service providers. This point often connects with other measures from the same list: a supplier that does not report vulnerabilities also affects the process for identifying and remedying vulnerabilities, and an incident at a supplier must follow the same route as an incident at the enterprise itself. Whether this question is mandatory at all depends on whether the enterprise itself falls under the directive — that is a separate question with its own answer.